Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 23:53

General

  • Target
    697721b990ab7f74aa7704a178426976_JaffaCakes118.exe
  • Size 463KB
  • Sample240723-3xsdlayhkf
  • SHA256 8062fbf234a512111bb51a168a992389c13c9d51aa31eded42cb245fda2f1569
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • imkansiz.dyndns.biz:52055

  • 127.0.0.1:52055

Mutex
  • mutex

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchust.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    imkansiz

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\697721b990ab7f74aa7704a178426976_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4140
        • C:\Windows\SysWOW64\install\svchust.exe
          "C:\Windows\system32\install\svchust.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3756
          • C:\Windows\SysWOW64\install\svchust.exe
            "C:\Windows\SysWOW64\install\svchust.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1544
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 560
              6⤵
              • Program crash
              PID:1516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 1544
    1⤵
      PID:4644

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 ddf1bfe6ea00a186c1df13e04fe2d98a808a861becccdae092812f3606db6a2f
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 6b5d972cab8e99e47b8f36ea3dac1719ac5a06ef099d94f6d8aa038ebee590a4
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 422a2f650da1d8395cf493d1b21ea1902b27371b59a1b98cffbc19064ed77d19
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c37dfd283349b8e399f16ec3c638f9826b629cf8c2e74c8d112c348d881f83fb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 25da5ab41dba266ac968aac25e11d54caf686e101bb552b8e938536a1de2fa0a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 57d826bb4a0882e1a56b8408eebe9c9019dd4f8f8e176aa4317e1b64a34e61f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1308c820dcb09617a26c75ec5a05efacf24b3acfaf9f0a0850fad7ce365bd177
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 55ca5a9fc5e9d69ed2d91d7795551296bb586285d2fc65757327e98869ba1383
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 79fd9e1af6d99bbb10235e5bc30b16dbfc2e14a6fd167449314bb5ef3089be74
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 93b308c00d1a4cc238426d2243c658a8176338f9234c15e9446eb186bc51b59a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 687f02ba16e8e57ee569da503448dfb01d5d0e419625122ab75468633ecec2f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8de6e106ef04554c21fe103c28d3c9c37ef468695503053eb1bceb4ddce06b4e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ff5c31e27ca7c937d46df272e799a5dd4497c0bfd7d35a0e19cbcc78cd6c25f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6dcd9d9ce6233ef691f38e40c5d439dc12eaa825da081e1e96a89e676559fbe9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a5564766d69b93b597fa86b151f44e2db8a075e6ad5048ec951f047baa39f0d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7ba46b951d0d0ce9cd19983fba509097888b9da6f160fd64d628d5d4a165c1c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a04fd698faed7aaa81b9c656140b60ef466c21a00db2b2776674e76fdc6105ad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94d2f5e1365c4cf3ab6851d6f87ce0b700995db66e7d9dcb4df83cbdf4a47779
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c59516881b976de7a28b7c05c5563e1721ea40aee5d8ff860746728708e940c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ef3a2a8ed2a6acf034b187bc63188b961a7936def6b3389d97e0b4bb52e9dcb5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 42cb8a23d3870d83e42995e9a4a9f6b663e5a15828c4739bc6ac36de9aa2d362
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 358a0713e66f2d9532a84470c78f1eec8e518ce1774fa5840b0f13d79a0c1cfd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88efb3926052adb4638994680a1ce8f3786a9a5e0e0960f30858a8e83fd63b58
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f17a336feffffceb3ef67cc70ab705f0e7a260634485c46a385979c4ac8164f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e5833375cf551c51622a0d324fffa2f6a885bd9fffa826248aa38e7c3bd25eb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 724198794b799c9621c0d1be3a4c979edbdf599d732ef582b05ac38b9f4e975c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfc9d281c45c9fbed3a1f0cd2de8d26cfda962ebaf504c7657a46573f7571378
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ca806beb4c7b1e848f4d99fb1e9f11b08e97c5baaff5eb0f497c55f43654fd9f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a517f921b8f5daf53610f3e64e53528dc68c8c33753fb46931eb01fdc684bb78
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d57f0c3e9de541b5403aa5770126f812fd55676b33d48952aa3e423c6160e896
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 51e4bda0e62f94f6b87bbff9690dfb99730d6b6b62b7bc87059f3d2528efe2b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2726385fddd221d4238e006f6a27cee2abbf671d849919f7b9ad6f11b0f7bfa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b65219db570d757889e248cf8ae9eb31d8dd0992d46c92913db17159f1af637
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f114e43ad147d0a5cb0afb1cd791db2da75bbc12f3882e3a73f1a144b5b7d6c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b987cb915df8be16d98284cb0475e2f6bfe46f8ad959bb58b04c00d718e77b06
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 600e6b3776a2c2a9ffe6320688da4a5e0b8a6ad9a3f03630a063ef91b9fe0ec6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d445b640f5f58eca73383bc7d5b4dbfff84120eb83b4efd87b70af0d6bd2d1f8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4cb7e5c3d690ee749204937e95c0d0686a6ea6c4738afc1c66d8366c4be0688e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e5e5b7d12c23596d10796ec1dd950439a7a8f7d70ad36fdfb73865777e52d812
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8f7701dd7173a93efb25343206dc1c83b757f85a4e5576226cd636d98371381b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b7c0a132c21107d3671ba60b7666cf6e2d669baf3bea3879b9fb404b81a44991
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c5fc0e2c80ade4ae8b6d4e34fa25b2d7fdd37be8b8bfe66fbfa85349210ecab9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2c71cf508741d9f39b81175d13f656d2e4f3a7add615edcd3af2c8d7058ea65f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f8dbcbff5e8e67497805bd71792685a2eb66e69c1b87cefc33c7fbe4c662827a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e46fc1013a5e02ca41be7c0871831e94b58a89b96e3de4299f067db7252844cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b27cca542ed1b6c18e900aaeff72749646500df014f27e031704c7487b463b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a6c2b6a14adf7c3f41380f43eee3ebe6c9d3b80091716bc4032d0534dd666f0d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bbe56b9461b24a7ef3eb0daa6119e6caf3d023e8423e7e170c14b857b19efce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b2f62aa69d86dda00e72a8e5e3a8d5a1c9b2a94ec31c39949625c49a9cac268
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 076a7b5213f5ec2f0ae1327b6d869540b987411502df2b0bf02dd2cedcf145cd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a769beb07cb7ee812e20f65e47f027abb46b2e6821908de56917f9121f5ca6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9cbea3f25bbea01db53dc551d45b024137ad9d9133a9c3e053cdb0507d98b082
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 26060e9370500a6e3f00827eec4da5c0997949175a61223098eb8ca656db55b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7e8e998683900eb0f9f208d1655b951b91123ddb2a22a625f8f5b766779db24
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 242603692ff96b1cc83caad1289048ef106a51c4264cf3b4394d996ff9b10360
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6c430559257a68e92549162c682f646bde4b6a63231099c8a647e11a564182cf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3fa82cf442844d69f61a2c8ec3f8d72316e765c39cc7a032ec880508cdedeafb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 108b800ded72403f61ddb5d8efb26b2fca8059df9dca970d0f49e3ea80a4bc7b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c066199a24fc7143b9731b83357719801ba5aac03758892624d2ed24a3976ad5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 354619342633d5ab878789ab6c7df448d08b56c5bca25eaa1b23cd7312477950
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 436e7a426fdaf1c48c22bfec7a31c88ee458871295b4bdd1432395e332e486b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dffadebf6212a12cd29051ff9a47ee1318c6184aa484bd5587fa0fa9cd27ddb5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b67a1b6f0621d2f08ec16c022fd9f7a692ecbb3ce8a4d7d6f34c717a403a2a7c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b3c986b9d22abaed60ff8416aed051ef1145c37b0aa3d83e592b410a32a11ec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b1656c59a6a70fd71fc9355dbb11dbae07f0a2c8a6636b2938d1fb5ba28a5f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bbe68dc74d1ed5436e92c19895beffa331066b3769d568402d95ab1a100e4303
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e46c8b025a09f01266d21d8efb420e1dbd1ccf9371d33fc4e9912168cda0790a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 41b1d87c0d6c3faae9fbc84954e0e6464a72434970a7dcd368482e71ce8bf191
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 589989de34e42a6dd4b8aeae5a7c56ae2497f464d943223a7905d8972518e5c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8a72a8102d84acc8a86c64df33ff73e584b0b953957302a36d61f339992db380
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e4ea6dab0ef00ff9e34caa474c95c1722bc9d9d564620b58fb3079d7e3e8651
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ad4dd0eeb30c4176711121aaba9f0af00c20521c21f77fbca29d70321602bd2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d7ed26b20963fe6f7c0587c9f1c8ede44d741d748d18f10ed71881e7a886861
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afafc0d7eba8b3213e2ffa17650bf9e13ca50dce1a65d66262f99de4055606af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 69f40cd48924ea931bc0746e4bcc9b211162b7dd3d7c8623495932651b80cb00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da585e06ba816704b0953ad1dc266382c16e6a9c239aa43fd1649e477b585771
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44a9ae492032fc86d3c715fe36b1a8291228188b1819c424a5fafb8924742992
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a730eb93aef8d7edadf29b9a12fa7460b0125718d5b586a4cd8d7cc4bde2b79e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ab58dee17231bdec8b15927c897f1c173e80fe65fef9652762cf4fa9c10e31e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd67db9933d39c3b2a5f7f7876c889fb2f0d2b5d300f07b26270e30a77b6bd8f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 499289b015ec4a1d2781edd38c822945fed87e1733a170cd90f485211711d779
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7fc0d5921bfa09825f4d9fa09e35e59c038bd7baed1983a6ca611768a2ce8f97
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 93a3e71c8a455e00288a0f689839dc256d5adf2908216013377de0b93b93a123
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 28a7cb691ab3d6df5a96a3788b26fa0c52fe06661ebd65d3bff836bae2f7a965
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4a2a7586b3fa6b8b0e0b88b2076883637dcb3753dfca095070626641bc7dd66
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b0f946ec507a37832ea15b89c4bcb64bd575b233a072987e5a1189192b9c711
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 64fec7859596cf7a44123b9b4ad79a6b1dbbbc5d7f48f5674512cc62b379cd6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 566eb01bd4ce7589bfc1336630a70523506bbcb7ea30f8d38e5f3608c7b2a97c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8193ea2c99da5e9249f1add5ecb1ef7cd4119cebd2deb784d99dbada02e57132
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 65b7e35b4d8c3f01a150428423d4faab9283da26246b0557379c5a63672f82db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9ceae63575634172bb8f3b8442a568caba722e4170ecfc893fcb75969510a7c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02b38125458485a3cf4258479129c7e77bfc8a0d5fad481c7a1b61704f1a1e7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2af72f63ff352c9324014a150d0c60bddcc7e0d432c0f6b0ccba806982d777e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b48ea9ebb98211b8e4b4c46058feb7f3bd9e33d7b4aa93ec63eb0bc76657ece
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 47401046960e1dd00bf92182d196b8abf3e097f2e6c7156161bfb35e2e8f3554
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e31d4697e958d529642bdc9ef9425d6d729351cc3709276a960b7718419cbec6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0620afd04e2dbe94529041ce3aeb73a32bb1464c17408307c5784d290580250f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2878d8bd905132870bcd639c54a77ce97a6d5303a844685118a6355eac839dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 14f0fceff0c025565cb6f0f44eabc97881a4a9ade3aa52a4aead961fc9899701
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 630fe6a34597fe57bf38af44be89d92a33146ced91f8639ea7c19b9e243655fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 08a45f827fa4753ae593833b512facdaf4a3ee92576c20eb47e872e957caafb8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18679d742ad158dbf50f9f33b33bd6e64d2eaaee8953aeeaf0d6ae32dbac7131
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3de7b7b3abe908c28da640031f0c7af3b6b03a7275d2502f660983aa11a1bc77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c08285afc55f13c1a2dbf19cf99f1e1f2d264ad7ce3119ece5b00ffd2a23fe4d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0188aa47de5144947994bf463224635e36935bf3a1ecc9310867027642199dfe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 630ced368ae1e4f46672f252c7d6574cf394825712e1cedb3029faf51dc98467
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 586da16d7219c80e5059e8325569f890d2153808caaf5a33151cb897309c69eb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 516125d1494e4473fc2ef343beec79924d22dc767db476a3dbcecf2ddbc5c296
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 01b0561d3bb624b91cabe664cac0b5ecee202f84afec38a528087876225dda16
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9c5e686574acdd5bf10f7a2ca6e4341d71ef95da14a16d7c685c3ea0b3287fd2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f8fd099a1d3e726e24a32c3aa3fd7412a213320ab41b5c88d5403dd70ded8de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ed7a838990f60922e4471d010d74c80cedb6f7fb6c74713a353bc1146e9d8734
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44724550b12c9f1f9cac0c785f72b35da845a6d8a22b1ea7c997baf94a937eee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ae6560dd0657035da73f5d3d897918af249d02b12a3e24799856999cf819101
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 098ef99ea4424ac299381f0a11349e5521bb0468dbd910c69742bbeefc81d96e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 28df8266167f564d1253e62f240668bf90ee1fca40cea4641b9f9e832b129afb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f828b82258506cd1c7bb0a425a8be3fa0a0c682aaf26504bb289a1fbb9d308f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 891b63e9c6547415ed3f3a5da23824735aa38bc370333a4d6741bf15f2c08c77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df5ee18f123148461219268cf46cadcd46183f0c30e91a00658086dcea6b65e1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a48ac2b0b778569d2054a6fb6a88b1d60e5619a4b32cec34b51767132bd148f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d04d3f46108a50ab4ed6156c81021f7de6df32ab8aa3e54ca56eefd2dd1cdbce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2667363a725b8a7c46ed90be5339692564ac8a951fdf90e282f9664313935b61
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36536a4ab9415d3508fa1d56b64290f8a848c9c6e7a4f41d6fb60dedcf92745e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e348479c7a28a1327ed95211016e528e01294ca07211894af580259176b57a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e86dced9b993f47fffb33af136ec2a22572452570301f5d02b0ecc54b7a15a9d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88dbb5c60c77134e867abb6852d2628145cc7939f3d46e487de276c87d897db2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 32cd06ade780e255547da3b131a908d08dbc4156023b06dea109484b9249de18
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52a387531ca3e7f566f6d6f7eb9d70727ed2768581bd496d4b5c5c549cf47740
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd426284fb1719471e168366e095f3de6f3b4eb2dfece45bd2185f7606e44365
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e3b6a2ceb9ae03ad9461391832ccbc8013d6d3ea1957c57bc8dd528625e2cc15
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 281ad2a391349b1fac0896b2b54b14fd4154862f332614b83d8982ce1ef560ed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 700fad43bf411202ef13bc62d43cddb9b3c628db053b8302b84c278d3ed8c703
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6795de042c24fd02449dd1179b7c28374e05f0c978b922b0daa9c233a9b6eb03
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d6a9680c4319e99d37aeb1df5d24f1cf879d872079681cf10f39b35029c563b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 75bed1bae70a23ba15e68328fd26595fadc18c1180ff86f419c1e98e52f454fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2644578db47fe603d8e602c2646c015818eec3e0f35f41cb719d1046ef50691a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec17c21fe20fabb0353ee9a3c3af2913fe01a30637688cbfdc31a8eb05a6bd6d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e4c964bcd9070142d261d33402d36e14ea2bc4ac9a9661be5f5521265eadd210
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c1538afc953bf616d7a984cdfb10c54ecccc8e48835ba95e4b5aef99448c585b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2e5655bea5be9601ea4a305807ff61c0ad8e608f1d79c16803078af82ca99ebc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 55a6c3e44c8bf0cd3b5d8259fb0cd3494dbd1cb87578c881a6d20a03009f1939
          • MD5 SHA1 SHA512

          svchust.exe

          • Path C:\Windows\SysWOW64\install\svchust.exe
          • Size 463KB
          • SHA256 8062fbf234a512111bb51a168a992389c13c9d51aa31eded42cb245fda2f1569
          • MD5 SHA1 SHA512 SSDEEP

          memory/1544-97-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/1544-100-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-73-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-5-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-8-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4004-4-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-3-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-2-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/4004-66-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4140-9-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/4140-10-0x0000000000590000-0x0000000000591000-memory.dmp

          memory/4140-69-0x0000000004530000-0x0000000004531000-memory.dmp

          memory/4140-12-0x0000000000400000-0x000000000042D000-memory.dmp